A tool for IDN homograph attacks and detection.

Related tags

Network ditto
Overview

Ditto is a small tool that accepts a domain name as input and generates all its variants for an homograph attack as output, checking which ones are available and which are already registered.

PoC domains

Using with Docker

The image on docker hub is updated on every push, you can just:

docker run evilsocket/ditto -h

Compiling from sources

Compiling from sources requires the go compiler, this will install the binary in $GOPATH/bin:

# make sure go modules are used
GO111MODULE=on go get github.com/evilsocket/ditto/cmd/ditto

Usage

To only transform a string:

ditto -string google

For a domain:

ditto -domain facebook.com

Use more concurrent workers to increase speed (WARNING: might cause a temporary IP ban from the WHOIS servers):

ditto -workers 4 -domain facebook.com

If instead of mutating the domain name you want to check other TLDs (throttle is set to 1s in order to avoid being blocked by WHOIS servers due to the many requests in a short timeframe):

ditto -domain facebook.com -tld -throttle 1000 -limit 100

Only show available domains:

ditto -domain facebook.com -available

Only show registered domains:

ditto -domain facebook.com -registered

Only show registered domains that resolve to an IP:

ditto -domain facebook.com -live

Show WHOIS information:

ditto -domain facebook.com -live -whois

Save to CSV file with extended WHOIS information:

ditto -domain facebook.com -whois -csv output.csv

Keep running and monitoring for changes every hour:

ditto -domain facebook.com -monitor 1h

The same but also keep and store the changes as JSON files:

ditto -domain facebook.com -monitor 1h -changes /some/path -keep-changes

Execute a command if changes have been detected (see example send-email-report.sh in this repo, automatically added to the docker image):

    ditto -domain facebook.com \
          -monitor 1h \
          -trigger "/usr/bin/send-email-report.sh {{.Domain}} {{.ChangesFile}} [email protected]"

For more options:

ditto -help

License

Released under the GPL3 license.

Owner
Simone Margaritelli
Simone Margaritelli
O365 is a tool designed to perform user enumeration* and password guessing attacks on organizations that use Office365

O365 is a tool designed to perform user enumeration* and password guessing attacks on organizations that use Office365 (now/soon Microsoft365). O365 uses a unique SOAP API endpoint on login.microsoftonline.com that most other tools do not use.

Trewis [work] Scotch 5 Jul 27, 2022
The Swiss Army knife for 802.11, BLE and Ethernet networks reconnaissance and MITM attacks.

bettercap is a powerful, easily extensible and portable framework written in Go which aims to offer to security researchers, red teamers and reverse e

bettercap 11.6k Aug 7, 2022
Log4Shell is a middleware plugin for Traefik which blocks JNDI attacks based on HTTP header values.

Log4Shell Mitigation Log4Shell is a middleware plugin for Traefik which blocks JNDI attacks based on HTTP header values. Related to the Log4J CVE: htt

Traefik Labs 33 Jul 26, 2022
A discord server guard which uses emojis and bot detection (WIP)

server-guard A discord server guard which uses emojis and bot detection (WIP) Config options SusLevel: how many checks the account has to fail before

post 10 Dec 6, 2021
Simple reverse shell to avoid Windows defender and kaspersky detection

Windows-ReverseShell Simple reverse shell to avoid Windows defender, kaspersky d

赵公子 11 Jun 9, 2022
Memberlist - Golang package for gossip based membership and failure detection

memberlist memberlist 是一个 Go 库,它使用基于 gossip 的协议来管理集群成员和成员故障检测。 这种库的用例影响深远:所有分布式系

null 1 Jan 26, 2022
Real-time HTTP Intrusion Detection

teler Real-time HTTP Intrusion Detection Contribute · What's new · Report Bug · Request Feature teler is an real-time intrusion detection and threat a

Kitabisa 1.7k Aug 3, 2022
Server-tool - A simple tool to run and create Minecraft servers

Server Tool A simple tool to run and maintain different Minecraft servers. This

Jack 1 Jan 6, 2022
This is a tool that allows you to check minecraft names availability, this tool can do around 3000~ names a minute or more!

Checker This is a tool that allows you to check minecraft names availability, this tool can do around 3000~ names a minute or more! Tutorial To instal

null 3 Feb 13, 2022
Traefik config validator: a CLI tool to (syntactically) validate your Traefik configuration filesTraefik config validator: a CLI tool to (syntactically) validate your Traefik configuration files

Traefik Config Validator Note This is currently pre-release software. traefik-config-validator is a CLI tool to (syntactically) validate your Traefik

Thomas Klinger 0 Dec 16, 2021
A tool that makes http requests and outputs the url and the content (optionally to file)

BKK Basic Crawler A tool that makes http requests and outputs the url and the content (optionally to file) How to run.. the tests go test the compiler

Jero Berlin 0 Nov 8, 2021
A quick and dirty but useful tool to download each text/html page from the wayback machine for a specific domain and search for keywords within the saved content

wayback-keyword-search A quick and dirty but useful tool to download each text/html page from the wayback machine for a specific domain and search for

null 41 Apr 20, 2022
PinGo is a standalone and feature-rich tool for common IP-based reachability checking tasks. Ping or Trace and Observe in real-time the statistics.

pingo As a network champion from designing and implementing to troubleshooting large scale networks - I know that is usually not easy for administrato

Jerome Amon 2 Jul 19, 2022
Golang tool to parse netblocks and domain names from SPF and get information about ASN

gospf Example Install go get github.com/incogbyte/gospf # get from releases ht

incogbyte 4 Apr 22, 2022
A C/S Tool to Download Torrent Remotely and Retrieve Files Back Over HTTP at Full Speed without ISP Torrent Limitation.

remote-torrent Download Torrent Remotely and Retrieve Files Over HTTP at Full Speed without ISP Torrent Limitation. This repository is an extension to

Bruce Wang 57 Oct 7, 2021
Command-line tool and library for Windows remote command execution in Go

WinRM for Go Note: if you're looking for the winrm command-line tool, this has been splitted from this project and is available at winrm-cli This is a

Brice Figureau 369 Jul 19, 2022